Vulnerability GHSA-7h5p-637f-jfr7
High Risk
HIGH RISK
CVSS Score: 8.6
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
June 19, 2026 at 09:15 PM UTC
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
3.0.0 - 4.0.0
3.0.0 - 4.0.0
Summary
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template
Details
Summary
The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote to escape the class and then inject arbitrary html/javascript to the final output.
Details
The template here adds a figure with a class that is substituted in. This value is provided to sprintf here, an unescaped version of the class supplied by the user.
$template = <<<HTML
<figure class="%s" data-service="%s" %s %s>
<div class="embedvideo-wrapper" %s>%s%s%s</div>%s
</figure>
HTML;
PoC
Note the double quote immediately following the single quote to escape the class attribute in the template:
<youtube class='" onmouseover="alert(document.domain)' id="dQw4w9WgXcQ">dQw4w9WgXcQ</youtube>
Impact
Arbitrary HTML can be inserted into the DOM by any user on any page, allowing for JavaScript to be executed.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 days ago
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
3.0.0 - 4.0.0 GHSA-v65j-hff3-753c
3.0.0 - 4.0.0 GHSA-v65j-hff3-753c
High Risk
3 months ago
StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
3.0.0 - 4.0.0 GHSA-5c7p-g73q-rpg5
3.0.0 - 4.0.0 GHSA-5c7p-g73q-rpg5
High Risk
3 months ago
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text
3.0.0 - 4.0.0 GHSA-c29q-5xm7-5p62
3.0.0 - 4.0.0 GHSA-c29q-5xm7-5p62
High Risk
1 year ago
Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes
3.0.0 - 4.0.0 GHSA-4j5h-mvj3-m48v
3.0.0 - 4.0.0 GHSA-4j5h-mvj3-m48v
Impacted packages
Timeline
Published
3 months ago
June 19, 2026 at 09:15 PM UTC
Fixed (4.1.0)
3 months ago
June 19, 2026 at 06:27 PM UTC
Last Modified
18 days ago
September 10, 2026 at 03:50 AM UTC